# CVE-2025-67903: Northern.tech Mender Client signature verification bypass

Source: https://junglewise.ai/threats/cve-2025-67903-northern-tech-mender-client-signature-verification-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2025-67903 · Severity: info · CVSS 0 · Published 2026-05-27

Northern.tech Mender Client, a tool used to manage over-the-air (OTA) software updates for IoT and embedded devices, contains a flaw in how it verifies digital signatures. An attacker could potentially bypass security checks to inject malicious files into a software update. If successful, this could allow an attacker to take full control of the affected device, though the risk is mitigated if using the standard Mender Server and default update modules.

Vendors: [Northern.tech](https://junglewise.ai/threats/vendors/northern-tech).

## Quick answers

**Is CVE-2025-67903 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67903 being exploited in the wild.

**How severe is CVE-2025-67903?** Informational severity, with a CVSS score of 0, published 27 May 2026.

**Which products and versions are affected?** Northern.tech Mender Client 5.0.0 to 5.0.3.

**Is there a fix for CVE-2025-67903?** A patch was published on 2026-05-27: Fixed in version 5.0.4 and 6.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-67903 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-67903?** Check whether you run Northern.tech Mender Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the signature verification logic of Mender Client (versions 5.0.0 through 5.0.3) allows an attacker to append additional files to a Mender Artifact without invalidating the cryptographic signature. The root cause is that the client may skip verification for files included in the artifact payload that are not explicitly listed with a checksum in the update manifest. While the default update modules (rootfs, directory, single file) and the standard Mender Server are not susceptible to this exploit, custom update modules that process unexpected files or custom delivery mechanisms that bypass server-side validation could allow an attacker to achieve remote code execution or device takeover. The issue is resolved in Mender Client version 5.0.4 and 6.0.0.

## Affected products

- Northern.tech Mender Client 5.0.0 to 5.0.3

## Timeline

- 2026-05-27: disclosed: Disclosed via HackerOne bug bounty program
- 2026-05-27: patched: Fixed in version 5.0.4 and 6.0.0
- 2026-05-27: advisory

## References

- [https://mender.io/blog/cve-2025-67903-signature-verification-bypass-in-mender-client](https://mender.io/blog/cve-2025-67903-signature-verification-bypass-in-mender-client)
- [https://northern.tech/](https://northern.tech/)